Reject redemption requests from synced users, surface a localized API message, and cover both model- and controller-level paths with tests.

Co-Authored-By: Codex <noreply@anthropic.com>